log
1 row where remote_addr = "10.1.48.192" and request = "GET /search/?tag=javascript&tag=fonts&tag=offlineresources&tag=firefox&tag=mozilla&tag=crossdomain&tag=html5&year=2009&type=blogmark&month=6 HTTP/1.1" sorted by request_time descending
This data as json, CSV (advanced)
| Link | rowid | line | measure#nginx.service | request | status_code | request_id | remote_addr | forwarded_for | forwarded_proto | via | body_bytes_sent | referer | user_agent | request_time ▲ | upstream_response_time | upstream_connect_time | upstream_header_time |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 434 | 434 | 2021-08-05T19:18:18.970764+00:00 app[web.1]: measure#nginx.service=6.500 request="GET /search/?tag=javascript&tag=fonts&tag=offlineresources&tag=firefox&tag=mozilla&tag=crossdomain&tag=html5&year=2009&type=blogmark&month=6 HTTP/1.1" status_code=200 request_id=65f0b1cd-4cb6-410b-a1a6-2673c3b51171 remote_addr="10.1.48.192" forwarded_for="54.161.41.102, 172.70.35.80" forwarded_proto="http" via="1.1 vegur" body_bytes_sent=13837 referer="-" user_agent="Mozilla/5.0 (compatible; Neevabot/1.0; +https://neeva.com/neevabot)" request_time="6.500" upstream_response_time="6.500" upstream_connect_time="0.000" upstream_header_time="6.500"; | 6.5 | GET /search/?tag=javascript&tag=fonts&tag=offlineresources&tag=firefox&tag=mozilla&tag=crossdomain&tag=html5&year=2009&type=blogmark&month=6 HTTP/1.1 | 200 | 65f0b1cd-4cb6-410b-a1a6-2673c3b51171 | 10.1.48.192 | 54.161.41.102, 172.70.35.80 | http | 1.1 vegur | 13837 | - | Mozilla/5.0 (compatible; Neevabot/1.0; +https://neeva.com/neevabot) | 6.5 | 6.5 | 0.0 | 6.5 |
Advanced export
JSON shape: default, array, newline-delimited
CREATE TABLE "log" ( [line] TEXT, [measure#nginx.service] FLOAT, [request] TEXT, [status_code] INTEGER, [request_id] TEXT, [remote_addr] TEXT, [forwarded_for] TEXT, [forwarded_proto] TEXT, [via] TEXT, [body_bytes_sent] INTEGER, [referer] TEXT, [user_agent] TEXT, [request_time] FLOAT, [upstream_response_time] FLOAT, [upstream_connect_time] FLOAT, [upstream_header_time] FLOAT );